Dev Tools

Editors, CLIs, Git workflows, and the tooling developers reach for every day.

All posts

A terminal window running gh agent-task create with the --follow flag, gh agent-task view, and gh agent-task list, noting that GitHub CLI v2.80.0 or later is required and the command set is still labeled preview

gh agent-task: Run Copilot Coding Sessions From gh

gh agent-task creates, follows, and lists GitHub Copilot coding-agent sessions from the terminal. Still preview, requires GitHub CLI v2.80.0+.

Aug 19, 2026Read more →

A dark comparison-matrix style cover reading gh CLI 2.97.0: Terminal Injection Fix, badged GHSA-3m3g-3wcr-px46 fixed 2026-07-31, listing the seven affected commands: gh gist view (truncated files), gh api (non-JSON responses), gh pr diff, gh release download --output -, gh codespace logs, gh skills preview, and gh agent-task view / create

Dev Tools

gh CLI 2.97.0 Fixes Terminal Injection in 7 Commands

GitHub CLI (gh) 2.97.0 fixes a terminal escape-sequence injection bug (GHSA-3m3g-3wcr-px46) across gh api, gh pr diff, and 5 more commands. Update now.

Aug 19, 2026Read more →

A terminal-style cover showing gh --version reporting the vulnerable 2.95.0 release, a GHSA-8cg3-r6g9-fpg2 / CVE-2026-59831 warning for the gh codespace jupyter remote code execution bug, then brew upgrade gh updating to the patched 2.96.0 release

Dev Tools

Update gh CLI Now: Codespace Jupyter RCE Fixed

A malicious Codespace could use gh codespace jupyter to hand VS Code a vscode:// URL and run commands on your machine. Fixed in gh CLI v2.96.0.

Aug 19, 2026Read more →

A terminal window showing the gh CLI apt keyring check gpg --show-keys /etc/apt/keyrings/githubcli-archive-keyring.gpg, listing the old key fingerprint expiring 2026-09-05 and the new key fingerprint added 2026-04-07, followed by the wget command that fetches the updated keyring

Dev Tools

gh CLI's New PGP Signing Key for Linux Packages

GitHub rotated the PGP key signing gh CLI's Linux apt/dnf/yum packages on 2026-04-08. Update your keyring before the old key expires Sept 5, 2026.

Aug 19, 2026Read more →

A terminal window running the real GitHub CLI commands gh issue edit 23 --parent 100, gh issue edit 100 --add-sub-issue 123,124, and gh issue edit 123 --add-blocked-by 200 --add-blocking 300,301, with a note that GitHub CLI v2.94.0 or later is required

Dev Tools

Manage GitHub Sub-Issues and Dependencies via gh CLI

Set parent issues, list sub-issues, and add blocked-by dependencies with gh CLI's issue edit and create commands, no browser needed.

Aug 19, 2026Read more →

A dark terminal window showing the real GitHub CLI commands gh discussion list --state all --label bug,enhancement, gh discussion view 123 --comments --order oldest, and gh discussion create --title My question --category Q&A --body Details here, with a note that GitHub CLI v2.94.0 or later is required and the feature is still in preview

Dev Tools

gh discussion: GitHub Discussions in Your Terminal

gh discussion adds list, view, create, edit, and comment subcommands to GitHub CLI, giving GitHub Discussions the same terminal ergonomics as issues and PRs.

Aug 19, 2026Read more →

A terminal-style cover comparing gh release download against a public repository before and after GitHub CLI v2.96.0: the pre-v2.96.0 run hits gh's shared authentication-required error, the v2.96.0-and-later run succeeds with no token and downloads the real gh_2.96.0_checksums.txt asset

Dev Tools

gh release download No Longer Needs Auth (Public Repos)

gh release download now works against public repos without auth, matching gh extension install. What changed in v2.96.0, and a CI example.

Aug 19, 2026Read more →

A terminal window running the real command gh skill install github/awesome-copilot documentation-writer --agent claude-code --scope user, with a note that GitHub CLI v2.90.0 or later is required

Dev Tools

gh skill: Manage AI Agent Skills From GitHub CLI

gh skill installs, searches, updates, and publishes AI agent skills for Claude Code, Cursor, and more, right from GitHub CLI.

Aug 19, 2026Read more →

A dark comparison-matrix cover titled gh skill --pin: Tag vs SHA, listing four rows: a tag is a mutable pointer, a SHA is content-addressed and cannot move, a tag is human-readable, a SHA is the reproducible choice for CI

Dev Tools

gh skill --pin: Tag vs Commit SHA, Which to Use

gh skill install --pin accepts a tag or a commit SHA. Pin to a SHA for CI reproducibility; a tag is fine for casual, supervised installs.

Aug 19, 2026Read more →

A dark comparison-matrix style cover reading GitHub CLI's 2026 Agent-Era Expansion, listing nine dated changes: the gh skill command, --pin tag vs commit SHA, gh discussion, sub-issues and dependencies, the Codespace Jupyter RCE fix, gh release download's dropped auth requirement, a terminal injection fix across seven commands, a new PGP signing key, and gh agent-task

Dev Tools

GitHub CLI's 2026 Agent-Era Expansion: Full Guide

GitHub CLI (gh) added skill, discussion, and sub-issue commands in 2026, plus two security fixes. Full guide to all 10 changes and what to do.

Aug 19, 2026Read more →

Dev Tools

How GitHub CLI Became an AI-Agent Control Surface

GitHub CLI (gh) shipped skill, discussion, and issue-hierarchy commands in 2026. See how gh became a real control surface for AI-agent tooling.

Aug 19, 2026Read more →

A terminal window showing the actions/checkout v7 changelog entry blocking fork pull request checkouts in pull_request_target and workflow_run workflows

Dev Tools

actions/checkout v7 Blocks pull_request_target PRs

actions/checkout v7 refuses to fetch fork PR code in pull_request_target and workflow_run by default. Here's the fix if your workflow relied on it.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions changelog entry describing approval requirements for bot-created pull requests before workflows can run

Dev Tools

Approve Workflow Runs From github-actions[bot] PRs

Pull requests from github-actions[bot] can now trigger CI workflows, but only after a collaborator approves the run. Here's how the gate works.

Aug 13, 2026Read more →

A terminal window showing the gh extension install github/gh-aw command and the verbatim changelog entry for GitHub Agentic Workflows public preview

Dev Tools

Set Up GitHub Agentic Workflows in Actions

GitHub Agentic Workflows (public preview) compiles Markdown into Actions YAML for AI-driven triage and CI analysis, sandboxed behind a read-only default.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions changelog entry describing read-only cache tokens for workflow events that can be triggered without write permissions

Dev Tools

GitHub Actions Cache Goes Read-Only on Untrusted Triggers

GitHub Actions now issues read-only cache tokens for untrusted triggers like pull_request_target, closing a cache-poisoning path. Here's what still writes.

Aug 13, 2026Read more →

A terminal window showing the verbatim changelog entry for GitHub Actions layered custom runner images: build custom images on top of other custom images

Dev Tools

Build Custom GitHub Actions Runner Images in Layers

GitHub Actions larger runners can now build a custom image on top of another custom image, plus conditional snapshot: generation for image versions.

Aug 13, 2026Read more →

A terminal window showing the verbatim changelog entry for GitHub Actions parallel steps: background: true runs a step asynchronously and immediately continues to the next step

Dev Tools

Run GitHub Actions Steps in Parallel With background

GitHub Actions steps can now run in parallel with background: true, wait, wait-all, cancel, and parallel. Here is when to use each keyword.

Aug 13, 2026Read more →

A terminal window showing the verbatim changelog entry for GitHub Actions' $/ self-repository syntax: resolves to your workflow's own repository at the exact commit that is running, with no checkout required

Dev Tools

Reference Same-Repo Actions With $/ Syntax

GitHub Actions' new $/ syntax resolves a same-repo action to the exact running commit, no checkout step needed. Requires runner 2.336.0 or newer.

Aug 13, 2026Read more →

A dark comparison-matrix style cover listing GitHub Actions' summer 2026 changes across three groups: security (checkout defaults, cache tokens, execution allow-lists), infrastructure (self-hosted runner floor, runner groups, layered images), and new syntax ($/ same-repo actions, parallel steps, agentic workflows)

Dev Tools

GitHub Actions' Summer 2026 Overhaul: Full Guide

GitHub shipped 10 Actions changes across June-July 2026: one breaking checkout default, a runner version cutoff, new security controls, and new syntax.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions self-hosted runner minimum version requirement: the runner must be on version 2.329.0 or later

Dev Tools

GitHub Actions: Upgrade Self-Hosted Runners by Jul 31

GitHub now enforces a minimum self-hosted runner version (2.329.0+) with brownout windows before full enforcement. Check your version before jobs stop running.

Aug 13, 2026Read more →

A terminal window showing the GitHub Actions workflow execution protections changelog entry describing an allow list for who can trigger workflows and which events are permitted

Dev Tools

Set Up GitHub Actions Workflow Execution Protections

Workflow execution protections let you allow-list who can trigger GitHub Actions workflows and which events are permitted, built on GitHub's rulesets.

Aug 13, 2026Read more →

A terminal window showing the verbatim changelog entry for GitHub-hosted runner group controls: disable the standard labels for hosted runners such as ubuntu-latest

Dev Tools

Restrict GitHub-Hosted Runners to Named Runner Groups

GitHub Team and Enterprise plans can disable standard runner labels like ubuntu-latest org-wide and force workflows through named runner groups instead.

Aug 13, 2026Read more →

A terminal window showing wrangler's real error: the legacy_env field is no longer supported, service environments have been removed

Dev Tools

Wrangler Removes Service Environments (v4.111.0)

Wrangler 4.111 removes service environments and legacy_env. Each environment now deploys as its own Worker, and here is the exact error and how to migrate.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entry: Remove containerEngine from the worker options returned by unstable_getMiniflareWorkerOptions

Dev Tools

Wrangler 4.117 Drops containerEngine From Miniflare

Wrangler 4.117 removes containerEngine from unstable_getMiniflareWorkerOptions. Custom local-testing harnesses reading it now get undefined, silently.

Aug 6, 2026Read more →

Dev Tools

Check Worker Bundle Size With wrangler check startup

wrangler check startup graduated from alpha in v4.116 and now shows real bundle size and a startup CPU profile. Run on this site: 3.95 KiB, gzip 1.54 KiB.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entry for wrangler 4.113.0: Add a settings export to the experimental cloudflare.config.ts config

Dev Tools

Wrangler's New cloudflare.config.ts settings Export

Wrangler 4.113 adds a defineSettings export to the experimental cloudflare.config.ts format, moving accountId and complianceRegion out of the Worker config.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entries for local dev observability: added in wrangler 4.114.0, enabled by default in wrangler 4.118.0

Dev Tools

Wrangler Now Traces Local Dev by Default (v4.118)

Wrangler 4.118 captures request traces and console logs into Local Explorer by default. Opt out with X_LOCAL_OBSERVABILITY=false if it causes trouble.

Aug 6, 2026Read more →

A real terminal capture of wrangler login --help, showing the actual --device flag description for the OAuth 2.0 Device Authorization Grant

Dev Tools

Wrangler Login Now Supports OAuth Device Grant

wrangler login --device (RFC 8628) skips the localhost callback for headless terminals. Confirmed live against wrangler 4.119.0, from this remote sandbox.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entry for wrangler 4.115.0: Add experimental local_dev.experimental_s3_credentials to r2_buckets config

Dev Tools

New r2_buckets Local Dev Credentials in Wrangler

Wrangler 4.115 adds local_dev.experimental_s3_credentials to r2_buckets bindings, scoping real S3-compatible credentials to local dev instead of faking R2.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entry for wrangler 4.116.0: Avoid Worker and workers.dev naming prompts in agent-driven deploys

Dev Tools

Wrangler Skips Naming Prompts in Agent/CI Deploys

Wrangler 4.116 detects non-interactive terminals and skips the first-deploy naming prompt automatically, fixing CI pipelines and AI agents driving the CLI.

Aug 6, 2026Read more →

A terminal window showing a real test: wrangler.jsonc silently wins over wrangler.toml, with no warning printed about the ignored file

Dev Tools

Fix Wrangler wrangler.toml vs jsonc Precedence

When both wrangler.toml and wrangler.jsonc exist, Wrangler silently uses jsonc with no warning. Confirmed by test, plus the fix for teams mid-migration.

Aug 6, 2026Read more →

A terminal window showing the verbatim changelog entry for wrangler 4.115.0: Support connect() on remote VPC Network and VPC Service bindings in local development

Dev Tools

VPC Bindings Now Connect in Wrangler Local Dev

Wrangler 4.115 lets connect() work on remote VPC Network and VPC Service bindings during local dev, closing a real gap that used to force stubs.

Aug 6, 2026Read more →

A dark comparison-matrix style cover listing Wrangler's July 2026 breaking changes: service environments removed, wrangler.toml vs jsonc precedence, containerEngine dropped from Miniflare, cloudflare.config.ts settings export, and local dev observability default-on

Dev Tools

Wrangler's July 2026 Breaking Changes: Full Guide

Wrangler shipped 10 changes across v4.111-4.119 in July 2026. One real breaking change, plus nine config, local-dev, and CLI shifts. Full rundown and fixes.

Aug 6, 2026Read more →

A developer working across multiple monitors and a laptop, each showing a different piece of code

Dev Tools

Git Worktrees: Multiple Branches Without the Stash Shuffle

A guide to git worktree: check out several branches into separate folders at once, skip the stash-switch-unstash cycle, and dodge the cloud-sync pitfall.

Jul 27, 2026Read more →